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This listing of claims will replace all prior versions and listings of claims in this 
application: 

Listing of Claims 

1. (Canceled) 

2. (Currently amended) A network comprising: 

a plurality of network nodes; 

a plurality of routing devices to route network traffics between selected ones of 
said network nodes; and 

a director coupled to said routing devices to determine whether selected instances 
of source addresses of packets routed by said routing devices are spoof source addresses, 
based at least in part on one or more consistency measures; 

The notworlc of claim 1 , wherein the director bases said determination on at least spatial 
distribution profiles of said source addresses, and in view of at least one reference source 
address spatial distribution profile. 

3. (Original) The network of claim 2, wherein said at least one reference source address 
spatial distribution profile comprises at least a selected one of an exemplary spatial 
distribution profile for a non-spoof source address in general, and a historical spatial 
distribution profile for a particular source address. 

4. (Currently amended) A network comprising: 

a plurality of network nodes; 

a plurality of routing devices to route network traffics between selected ones of 
said network nodes; and 

a director coupled to said routing devices to determine whether selected instances 
of source addresses of packets routed by said routing devices are spoof source addresses, 
based at least in part on one or more consistency measures; 
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The network of claim 1 , wherein the director bases said determination on at least 
destination source address range (DSAR) distribution profiles of said source addresses, 
and in view of at least one reference DSAR distribution profile. 

5. (Original) The network of claim 4, wherein said at least one reference DSAR 
distribution profile comprises at least a selected one of an exemplary DSAR distribution 
profile for a non-spoof source address in general, and a historical DSAR distribution 
profile for a particular source address. 

6. (Currently amended) A network comprising: 

a plurality of network nodes; 

a plurality of routing devices to route network traffics between selected ones of 
said network nodes; and 

a director coupled to said routing devices to determine whether selected instances 
of source addresses of packets routed by said routing devices are spoof source addresses, 
based at least in part on one or more consistency measures; 
The notworlc of claim 1 , wherein the director bases said determination on at least 
migration distribution profiles of said source addresses, and in view of at least one 
reference migration distribution profile. 

7. (Original) The network of claim 6, wherein said at least one reference migration 
distribution profile comprises at least a selected one of an exemplary migration 
distribution profile for a non-spoof source address in general, and a historical migration 
distribution profile for a particular source address. 

8. (Currently amended) The network of claim i- 10, wherein the director bases said 
determination on at least timing distribution profiles of said source addresses, and in view 
of at least one reference source address timing distribution profile. 
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9. (Original) The network of claim 8, wherein said at least one reference source address 
timing distribution profile comprises at least a selected one of an exemplary timing 
distribution profile for a non-spoof source address in general, and a historical timing 
distribution profile for a particular source address. 

10. (Currently amended) A network comprising: 

a plurality of network nodes; 

a plurality of routing devices to route network traffics between selected ones of 
said network nodes; and 

a director coupled to said routing devices to determine whether selected instances 
of source addresses of packets routed by said routing devices are spoof source addresses, 
based at least in part on one or more consistency measures; 

The network of claim 1 , wherein the director is further equipped to determine whether 
filtering actions are to be taken to filter out packets with source addresses having 
instances deemed to be spoof source addresses, and if filtering actions are to taken, where 
among said routing devices, said filtering actions are to be taken. 

1 1 . (Original) The network of claim 10, wherein the director takes into consideration in 
making said where determination, where packets of non-spoof instances of a source 
address having instances deemed to be spoof source addresses are likely to be routed in 
said network. 

12. (Currently amended) The network of claim 1 10, wherein the director comprises a 
plurality of director devices cooperatively coupled to each other to jointly make said 
determination. 

13. (Currently amended) The network of claim i 10, wherein the network further 
comprises a plurality of sensors, either integrally disposed in a subset of said routing 
devices or externally disposed and coupled to the subset of routing devices, to monitor 
and report on source addresses of packets routed through the subset of routing devices. 
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14. (Original) The network of claim 13, wherein the sensors are further equipped to 
facilitate application of desired source address based filtering on packets being routed 
through selected ones of said subset of routing devices. 

15. (Canceled) 

16. (Currently amended) A networking method comprising: 

receiving information associated with source addresses of packets being routed to 
and from a plurality of network nodes of a network; 

determining whether selected instances of said source addresses are spoof 
instances of said source addresses, based at least in part on one or more consistency 
measures; and 

managing said network based at least in part on the results of said determination; 
The method of claim 15, wherein said determination is made based at least in part on 
spatial distribution profiles of said source addresses, and in view of at least one reference 
source address spatial distribution profile. 

17. (Previously presented) The method of claim 16, wherein said determination 
comprises constructing said spatial distribution profiles of said source addresses. 

18. (Original) The method of claim 16, wherein said determining comprises determining 
whether each of the spatial distribution profiles of the source addresses is within a 
resemblance tolerance limit when compared to each of the at least one reference source 
address spatial distribution profile. 

19. (Original) The method of claim 16, wherein said at least one reference spatial 
distribution profile comprises at least a selected one of an exemplary spatial distribution 
profile for a non-spoof source address in general, and a historical spatial distribution 
profile for a particular source address. 
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20. (Currently amended) A networking method comprising: 

receiving information associated with source addresses of packets being routed to 
and from a plurality of network nodes of a network; 

determining whether selected instances of said source addresses are spoof 
instances of said source addresses, based at least in part on one or more consistency 
measures; and 

managing said network based at least in part on the results of said determination; 
The method of claim 15, wherein said determination is made based at least in part on 
destination source address range (DSAR) distribution profiles of said source addresses, 
and in view of at least one reference DSAR distribution profile. 

21 . (Previously presented) The method of claim 20, wherein said determination 
comprises constructing said DSAR distribution profiles of said source addresses. 

22 (Original) The method of claim 20, wherein said determining comprises determining 
whether each of the DSAR distribution profiles of the source addresses is within a 
resemblance tolerance limit when compared to each of the at least one reference source 
address DSAR distribution profile. 

23. (Original) The method of claim 20, wherein said at least one reference DSAR 
distribution profile comprises at least a selected one of an exemplary DSAR distribution 
profile for a non-spoof source address in general, and a historical DSAR distribution 
profile for a particular source address. 

24. (Currently amended) A networking method comprising: 

receiving information associated with source addresses of packets being routed to 
and from a plurality of network nodes of a network; 
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determining whether selected instances of said source addresses are spoof 
instances of said source addresses, based at least in part on one or more consistency 
measures; and 

managing said network based at least in part on the results of said determination; 
The method of claim 15, wherein said determination is made based at least in part on 
migration distribution profiles of said source addresses, and in view of at least one 
reference migration distribution profile. 

25. (Original) The method of claim 24, wherein said determining comprises 
constructing said migration distribution profiles of said source addresses. 

26. (Original) The method of claim 24, wherein said determining comprises determining 
whether each of the migration distribution profiles of the source addresses is within a 
resemblance tolerance limit when compared to each of the at least one reference source 
address migration distribution profile. 

27. (Original) The method of claim 24, wherein said at least one reference migration 
distribution profile comprises at least a selected one of an exemplary migration 
distribution profile for a non-spoof source address in general, and a historical migration 
distribution profile for a particular source address. 

28. (Currently amended) The method of claim j-5 16, wherein said determination is 
made based on at least timing distribution profiles of said source addresses, and in view 
of at least one reference source address timing distribution profile. 

29. (Original) The method of claim 28, wherein said determining comprises 
constructing said timing distribution profiles of said source addresses. 

30. (Original) The method of claim 28, wherein said determining comprises determining 
whether each of the timing distribution profiles of the source addresses is within a 
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resemblance tolerance limit when compared to each of the at least one reference source 
address timing distribution profile. 

3 1 . (Original) The method of claim 28, wherein said at least one reference timing 
distribution profile comprises at least a selected one of an exemplary timing distribution 
profile for a non-spoof source address in general, and a historical timing distribution 
profile for a particular source address. 

32. (Currently amended) The method of claim i& 16, wherein said managing comprises 
determining whether filtering actions are to be taken in said network to filter out at least 
some packets having source addresses deemed to be having spoof instances, and if 
filtering actions are to be taken, where among a plurality of routing devices, said filtering 
actions are to be taken. 

33. (Original) The method of claim 32, wherein said where determination comprises 
taking into consideration where packets of non-spoof instances of a source address 
having instances deemed to be spoof source addresses are likely to be routed in said 
network. 

34. (Previously presented) An apparatus comprising: 

(a) a storage medium having stored therein a plurality of programming 
instructions designed to implement a director to receive reporting of information 
associated with source addresses of packets routed through a plurality of routing devices 
of a network, and to determine whether at least some instances of said source addresses 
are spoof instances based on at least spatial distribution profiles of said source addresses, 
and in view of at least one reference source address spatial distribution profile; and 

(b) a processor coupled the storage medium to execute the programming 
instructions. 

35. (Cancelled) 
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36. (Previously presented) The apparatus of claim 34, wherein said programming 
instructions are designed to be able to construct said spatial distribution profiles of said 
source addresses. 

37. (Previously presented) The apparatus of claim 34, wherein said programming 
instructions are designed to be able to determine whether each of the spatial distribution 
profiles of the source addresses is within a resemblance tolerance limit when compared to 
each of the at least one reference source address spatial distribution profile. 

38. (Original) The apparatus of claim 34, wherein said programming instructions are 
designed to make said determination based on at least destination source address range 
(DSAR) distribution profiles of said source addresses, and in view of at least one 
reference source address DSAR distribution profile. 

39. (Original) The apparatus of claim 38, wherein said programming instructions are 
designed to be able to construct said DSAR distribution profiles of said source addresses. 

40. (Original) The apparatus of claim 38, wherein said programming instructions are 
designed to be able to determine whether each of the DSAR distribution profiles of the 
source addresses is within a resemblance tolerance limit when compared to each of the at 
least one reference source address DSAR distribution profile. 

41. (Original) The apparatus of claim 34, wherein said programming instructions are 
designed to make said determination based on at least migration distribution profiles of 
said source addresses, and in view of at least one reference source address migration 
distribution profile. 
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42. (Original) The apparatus of claim 41, wherein said programming instructions are 
designed to be able to construct said migration distribution profiles of said source 
addresses. 

43. (Original) The apparatus of claim 41, wherein said programming instructions are 
designed to be able to determine whether each of the migration distribution profiles of the 
source addresses is within a resemblance tolerance limit when compared to each of the at 
least one reference source address migration distribution profile. 

44. (Original) The apparatus of claim 34, wherein said programming instructions are 
designed to make said determination based on at least timing distribution profiles of said 
source addresses, and in view of at least one reference source address timing distribution 
profile. 

45. (Original) The apparatus of claim 44, wherein said programming instructions are 
designed to be able to construct said timing distribution profiles of said source addresses. 

46. (Original) The apparatus of claim 44, wherein said programming instructions are 
designed to be able to determine whether each of the timing distribution profiles of the 
source addresses is within a resemblance tolerance limit when compared to each of the at 
least one reference source address timing distribution profile. 

47. (Original) The apparatus of claim 34, wherein said programming instructions are 
designed to be able to determine whether filtering actions are to be taken in said network 
to fiher out at least some packets having source addresses deemed to be having spoof 
instances, and if filtering actions are to be taken, further determine where among a 
plurality of routing devices, said filtering actions are to be taken. 

48. (Original) The apparatus of claim 47, wherein said programming instructions are 
designed to take into consideration where packets of non-spoof instances of a source 
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address having instances deemed to be spoof source addresses are likely to be routed in 
said network, when making said where determination. 
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